Webhook

Introduction

You can configure webhooks to monitor events on your account, enabling your system to receive notifications.

CAMP relies on webhooks to notify you whenever an event occurred on your account, such as the completion of transactions. This is useful for handling asynchronous operation in real time.

To use webhooks with your CAMP integration:

Create a webhook endpoint in your system.

Contact MetaComp at api_support@mce.sg and provide your webhook endpoint to be added to our backend.

Simulate an event to test your webhook endpoint.

Implement validation of webhook signatures. (Optional)

Webhook Request

Below are the following webhook notifications that you can set up:

Create End User Account Status

Deposit Status

Withdrawal Status

OTC Trading Status

Payment Request Status

Webhook Retry Logic

To acknowledge receipt of an event, your endpoint must return a 2xx HTTP status code to CAMP and the response format should be application/json. Otherwise CAMP will assume the event was not received and it will retry the webhook for up to 24 hours using an exponential backoff strategy.

Webhook Verification

About verifying webhook

Once your system is configured to receive payloads, it will listen for any delivery that is sent to the configured endpoint. To ensure that your system only processess webhook deliveries that were sent by CAMP and ensure that the delivery was not tampered, you should verify the webhook signature before processing them.

To verify webhook signature

There will be X-Signature header included in all webhooks that contains a timestamp and a signature that you need to verify. The timestamp has a t= prefix, and signature has a v0= prefix.

X-Signature: 
t=1758867971711,
v0=b2468f1bc285eb64be242ee6d02e3c959dfb61482abe47ddb50da4b6be55997e

Steps to verify webhook signature

Step 1: Get the secret key

Go API Integration page to retrieve the secret key that used to generate signature.

Step 2: Extract timestamp and signature

Split the header using , character as the delimiter and get the values for timestamp t and signature v0.

Step 3: Prepare the `signed_message` string

Concatenate the timestamp and webhookData from the request body, separated by a _ character to form the signed_message.

Step 4: Compute the expected signature

Use the secret key as private key and use hash-based message authentication code (HMAC) with SHA-256 algorithm to encrypt the signed_message to generate the expected signature.

Step 5: Compare the signature

Compare the signature in the webhook request payload with the expected signature.

Preventing replay attacks

To prevent replay attacks, you may like to check the timestamp t against the current time and reject events that are too old. It is recommended to have a tolerance of 3 minutes between the timestamp and current time.

Introduction#

Webhook Request#

Webhook Retry Logic#

Webhook Verification#

About verifying webhook#

To verify webhook signature#

Steps to verify webhook signature#

Step 1: Get the secret key#

Step 2: Extract timestamp and signature#

Step 3: Prepare the signed_message string#

Step 4: Compute the expected signature#

Step 5: Compare the signature#

Preventing replay attacks#